Gmail enters the "extend" phase of Embrace, Extend, Extinguish by creating new proprietary features for email then forcing non-gmail users the view the mail through a link with Google Login (and sometimes SMS confirmation!)

@paul guess it's time to get on Protonmail's paid plan...


I agree. Support other email providers. google obviously feel they have a critical mass of users now that this move is worth it.

If I ever receive one of these links I will ask the sender to use another method


Worth remembering even for self-hosters:

Network effects increase the extent to which *other* people's choices affect us.


@paul @Antanicus @ritjoe totally true, but I would rather they had some of my email rather than all of it. Plus moving away yourself encourages others to do so and keeps the alternatives viable

@bgcarlisle @Antanicus Ah is this why gmail has adopted something similar? Worried about the competition.

I wonder if the two implementations are interoperable? (I'll take a guess and say no!)

Yeah I'm not in favour of Proton Mail doing it either, although I don't know if they require a login and/or sms verification to view the mail.

Maybe best look at another provider or do what I do and self-host.

@paul @Antanicus I mean, I don't think it will be used, or that it's a threat to email

I've had this feature on Protonmail for months and it's just not that useful, nor is it evil

I think the bigger threat is how Gmail kinda-sorta blocks smaller email providers

And I would highly recommend Protonmail, btw

@bgcarlisle @Antanicus I'd say it's more of a worry when gmail does it because of how much of control they have over the email ecosystem. Once they can start dictating protocol changes then we're in big trouble.

@paul @Antanicus Yeah true

I guess it's just not that useful a feature?

I'm trying to think of a really good use case, but it's not coming to me

@bgcarlisle @Antanicus yeah none of this is going to prevent screenshots or similar. Seems like the whole thing is a bit of security theatre

@paul then it's not email, and we can safely ignore it.

@paul The article didn't mention how this works with google's ad placement within gmail. Do you know? Or have google said? Scanning an email in order to place ads, a normal gmail function, doesn't seem very compatible with confidentiality. (I searched but only found other articles basically recapping the same info as the one you linked.)

@jannamark Apparently because of the upcoming GDPR Gmail no longer scans emails to help build advertising profiles

But I don't think this new feature would make a difference anyway as it sounds like Google always has the keys any confidential email sent.

It would stop any competitors from reading the email though..

@paul And thus we enter the era of screenshot email saving 🙄

@paul And of course, Google will still read your confidential mail and monetize your data.

@phryk They claim they don't do that anymore, but there's no way of knowing for sure

@paul Even if that one is technically correct, they still have your complete social graph and I *highly* doubt, they'll ever stop using gmail metadata – it's just too damn valuable for them.

@phryk too right. They're too scared of Facebook to give all that up for nothing

I’ve been considering moving away from Gmail for a while now, but so much of my online identity is tied to that gmail account.

So many logins. So many rarely used services.

I don’t think I could get away with abandoning it entirely, but I could probably get another address set up with another service and start the migration? A domain I control, but hosted through a big service?


@ajroach42 If you're used to sysadmin tasks, setting up your own email server with postfix/dovecot and friends is pretty easy and once it's done, requires minimal maintenance. I've been running my own server for years.

If you don't have the time or desire, setting up a custom domain on Protonmail or Fastmail along with redirection for your old address should take no longer than an hour.

Then it's just a case of updating accounts to use the new address

@paul @ajroach42 Don't you effectively need a static IP with valid reverse DNS (in other words, time to get business class internet or a VPS) if you want mail to actually work?

@bhtooefr @paul if You’re going to actually self host, yes. But I have those things.

@paul @bhtooefr @ajroach42 I'm lucky, my isp provides a static IP for £1 per month so self hosting from home is easy. In the past I have also hosted from home on a dynamic ip with no reverse DNS and only ever had deliverability problems to hotmail addresses occasionally. There aren’t actually many servers that will block you just for having dynamic IP

@paul @bhtooefr And you haven't run in to problems where spam filters erroneously catch your emails?

That's my biggest worry against self hosting.

@bhtooefr @paul @ajroach42 no never. I make sure DKIM and SPF are good and deliverability is fine. The only issues have been Microsoft just dropping emails occasionally. There are loads of post on stack overflow and elsewhere where ppl suffer the same thing. Their servers say they have received the message and will deliver it, then it’s just dropped with the receiver never seeing the email.

@bhtooefr @paul @ajroach42 you have to find the well hidden MS tools to register ownership of your domain/IPs and that helps. Will send you a link once I’m near a computer. They also try to up sell you to a company called returnpath which will guarantee you always get delivered to Outlook/Hotmail for about $5000 dollars per year. It’s a total racket.

@paul I’ve done this in the past, but I ran in to trouble with the spam filters.

@ajroach42 @paul First step in getting away from GMail is an email address at your domain.

Doesn't matter where you host it. Just start transitioning to it, and you can change hosts at your leisure.

My email was first hosted with Google Apps, then with Cotse, and now with Fastmail (which I love and recommend.)

@paul I'm glad that I already began to transition from Gmail to @Tutanota.

@paul like ProtonMail haven't been doing the same for encrypting messages to non-PM users.

@tdemin if they have that’s bad (and do they require login and sms verification?), but they don’t have the same level of influence as gmail so it’s not much of a threat yet.

@paul @tdemin Protonmail only needs a passphrase to access a message not login/sms. They give a place for you to give a hint. Otherwise it's up to you to provide the shared secret outside of the email.

I'd prefer encryption at the user level via pgp, but this at least gives me the option to force people to embrace it if they want to read my message. My track record for selling pgp use is pretty much nil.

On the other hand, it vastly increases social engineering risk.

@fullywoolly @tdemin yeah I don't think there is anyone on earth that has managed to successfully get anyone else to use PGP unless they already had it set up and understood it!

Something like the signal protocol over email would be nice, but I think most ppl see email as being insecure forever sadly

@paul @tdemin my uncle managed to capture my imagination with pgp as a youth. I'll admit I haven't used it recently.

I agree with the signal approach. But even getting people on signal when they already have 14 others they use has also been an uphill struggle.


I hope this time people will realize that stallmann was right: all non-freesoftware is inherently evil.

@paul What are you talking about, they are never gonna remove the XMPP capabilities of Google talk, let alone replace it with something like Hangouts, that would be ridiculous!

@paul Same is the case with ProtonMail's encrypted email that only works between users of the same email service, disregarding technologies like PGP which work irrespective of email providers.

Thunderbird's enigmail should be made easier to use. And a mobile version maybe. These should be recommended instead of ProtonMail.

#email #encryption #protonmail

@metalbob aye I agree with this, although not sure if PGP/GPG is simply too much for the average user to manage successfully over multiple devices without it ending in tragedy

@paul That article mentions an optional SMS code but not login. I guess it's no more confidential than email if it doesn't require login, though.

Definitely going to auto-reject these on my mail server.

@paul If I have to log into Google to view one of their screwball "self-destructing" emails I'm going to email the sender back and say "please send me a normal email". Proprietary extensions defeat the whole purpose of email, and the entire purpose of many emails is to be a semi-permanent record. Take that away and we may as well be communicating by smoke signals.

@paul looks like a solution in search of a problem... it's only going to be as secure as the end recipient's system (ignoring the blatant security hole of trusting Google to begin with), and while you may not be able to "forward, download or copy" the message I'd be incredibly surprised if they found a way to block screenshots...

@paul well, it's simple: if one day I receive an email that uses this feature, I simply reply the sender to send me the email again, without using that shitty function.

@paul Where is the part about requiring logging in with Google to view such a link? Am I missing it?

@tw that's an assumption on my part. Every time I have received links to google hosted content in the past the first thing I see is a login form. They would likely use it as a bypass for receiving the sms to view the message

@paul Could be. I saw an SMS passcode mention, but that appeared to be a feature the sender could choose to enable or not.
Even if this works without a login at the start, I don't trust Google to necessarily keep it that way, nor do I trust them not to continue with the Embrace, Extend, Extinguish pattern in some fashion. More importantly, another article pointed out there was no mention of encryption with this feature, either, so it sounds more like a gimmick than anything to me.

@tw yeah very likely. @unextro mentioned Microsoft have recently rolled out this feature for office365 so google are playing catch-up with them. Possible they just want to have the feature for that reason rather than as a true secure system.

It certainly sounds like something that bosses would like without thinking of the many ways it isn’t secure!

@paul Would like to point out that it's most likely in reaction to Micro$oft doing the same thing already...

@unextro oh they’re all at it! Tbh I thought this looked more like a Microsoft tactic Than google, and there it is!

I’ll actually be surprised if it does work “seamlessly” in outlook, because normal email doesn’t

@paul For all the talk about the new Microsoft it still look the same to me under the new coating.

Already in their usual game with PWAs... "PWAs installed via the store will ... have access to the full suite of WinRT APIs available to UWP apps. They can differentiate their experience on Windows 10 with enhancements like access to local calendar and contacts data (with permission) and more." (

@unextro yes agreed. It surprises me that anyone thinks they have changed! Although maybe the comments I see are paid MS posts planted to sway opinion

Sign in to participate in the conversation is one server in the network